WinKill[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

WinKill.exe
Size

50.1MB
MD5

2d5eae59fb7daebda356af7ee7520c77
SHA1

5aac2bf035d21b55bc462a85e705384e9be833fe
SHA256

3ca2d2cd16bfa71b3513a1dc4b8decf5e94c06b61866957f33abd1468077b8cf
SHA512

6078293eb59453b01ef42dba7ccf6b89b6ea9a24b66edc6b4dffea3c44e2898deeb7a94690a9add90360cc561534ec74424ec7b26e45558a0e59887c991b31c6
SSDEEP

768:pQvWjxdBMccyYl3clXy50mK9xeaixrEgTqkoiW/gXSKIrvDsH7dq4rY5HE3:pFjBZnYRci05beaAK4IrvDIq+/3

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
WinKill.exe

Files

WinKill.exe
.exe windows x86

817ef9008c62c37a749407cc263c0e32

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvbvm60

ord582
MethCallEngine
ord517
ord626
ord667
ord593
ord594
ord595
ord598
ord521
ord631
ord525
ord526
EVENT_SINK_AddRef
ord529
DllFunctionCall
EVENT_SINK_Release
EVENT_SINK_QueryInterface
__vbaExceptHandler
ord712
ord606
ord607
ord608
ord717
ord534
ProcCallEngine
ord535
ord536
ord537
ord681
ord685
ord100
ord616
ord618

Sections

.text
Size: 37KB - Virtual size: 36KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ